Privacy Policy

This policy covers everyone who uses Common Elements, Inc. (“CE,” “we,” “us”): board members, association staff, management company employees, vendors, attorneys, insurance professionals, and anyone visiting our public pages. Common Elements operates from Florida and serves U.S.-based community associations and the businesses around them. It also covers people who have never created an account: association officers and board members whose names we compile from government records, and licensed professionals and businesses listed in state license rolls and business directories, described under “Public-record and directory data” below.

The data we collect falls into three buckets:

• Account information you give us: email address, full name, organization name, role within that organization, and (optionally) phone number, biography, avatar, professional credentials (LCAM, license numbers, attorney bar admission), and contact-visibility preferences.
• Content you create on the platform: forum posts, RFPs, proposals, reviews, direct messages, follow relationships, and any documents you upload.
• Operational data we collect automatically: authentication tokens, session timestamps, IP addresses, browser metadata, error reports, and usage events (which pages were visited, and clicks and other actions, captured automatically). For a sample of visits we also record a session replay of how the page was used, with all text and form inputs masked. We measure site traffic with PostHog, Google Analytics and Vercel Analytics. We do not run advertising trackers and do not sell or share this data with ad networks.

Separately from the account and content data above, Common Elements compiles a directory of community associations and their officers from government records: state corporate and homeowners-association filings (for example, Florida’s Division of Corporations and DBPR license records), county recorder and property-appraiser records, and similar public filings. This is how an association gets a page on Common Elements even when no one from that association has signed up. We also compile licensed professionals (such as community association managers and contractors) and businesses from state license rolls and business listings, and we may email them at the business address on record about Common Elements. To stop those emails, use the unsubscribe link where one is provided, reply to the email, or write to privacy@commonelements.com.

For officers and board members, the free platform, the forum, and the public directory show name, role, and the association’s own filed address only. Personal email addresses, phone numbers and mailing addresses for officers and board members, where we hold them, come from external sources, never from a person’s own Common Elements account. They are not shown on any surface outside Common Elements staff, free or paid, including the data product, exports and connected apps.

If you are an officer or board member, whether or not you have a Common Elements account, and want to know what we hold about you from public records, or want it corrected or removed, email privacy@commonelements.com.

Common Elements Brain, formerly Common Elements Insight, is an optional Chrome extension. It shows what Common Elements knows about the page you are on: the association behind a real estate listing on Zillow, Redfin, Realtor.com or Trulia, or the Common Elements record for an association, vendor or management company when you are on its own website. It is independent and not affiliated with or endorsed by any of those sites.

What it reads, on your device: to work out what a page is about, Brain reads the current page inside your browser. On a listing, that is the property address, ZIP, state, approximate coordinates and the association name if the listing shows one. On any other site, it is only the site’s domain name, which Brain checks against a list of hashed domains it downloads once a day. That list contains no names, and the check happens on your device.

When it runs: on a page where you click the Brain toolbar button, on a site you have chosen to allow, or, if you turn on automatic recognition of association, vendor and management company websites (off by default), on the sites you visit. With automatic recognition on, the only thing that runs on every site is that local check. A site that is not already a Common Elements record sends nothing to us, so we do not learn which other sites you visit.

What it sends, and when: only when it has recognized the page and you open the panel, or on a site you allowed. For a listing: the address, ZIP, state, coordinates rounded to about ten meters, the association name shown on the listing, and the listing’s id. For a website: the domain, plus the first part of the page path on shared hosting sites such as Google Sites. Nothing else: never the page’s HTML or text, cookies, form contents, full page addresses, or your browsing history.

What we keep from it: nothing. We answer the request with the matching association, vendor or management company and discard it. The address or domain you sent is not stored or logged. Free-use limits are counted against the install id or your account, not against the address.

Contributing what you see (optional, off by default): if you turn this on, Brain can send public, non-personal facts about an association or vendor from that association’s or vendor’s own website, and only when that website is already a Common Elements record: the association’s name, the fee amount and how often it is charged, amenities, the management company’s name, and the association’s or business’s own address. It never contributes anything from listing sites such as Zillow or Redfin, from pages behind a login, or from sites that are not Common Elements records, and it never sends anyone’s personal email, phone number or home address. Contributions are stored with the install id (and your account, if linked) and reviewed by our staff before they are used. You can turn this off at any time in the extension’s settings.

Brain does not contribute listing facts. Earlier versions of Insight offered an opt-in that sent factual listing details; that option is retired, and the small number of facts contributed through it before then are retained in our association database.

Install id and account linking: the extension creates a random install id when it is installed. It is not derived from you, your device, or your Google account, and it is destroyed when you remove the extension. If you sign in, the commonelements.com sign-in page hands your session to the extension so it can act on your account.

Anonymous usage statistics: the extension records which steps it reaches so we can tell when it breaks: for example “installed”, “panel opened”, “a page was recognized” and which kind of page, “no match”, which action button was used, whether you allowed a site when asked, and whether you changed the contribution setting. These records are tied to the install id. They never include addresses, domains, page addresses, record ids, or anything you type. You can turn this off in the extension’s settings.

The use of information received from Common Elements Brain adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. We use the data described above only to provide and improve the association-data features of the extension and platform. We do not sell it, use it for advertising, or transfer it to determine creditworthiness or for lending purposes.

The Common Elements app for iOS and Android collects the same account information and platform content described above. A handful of things are specific to a phone. Every one of them is optional, is requested only when you use the feature that needs it, and the app keeps working if you decline.

• Precise location: used to geotag a site walkthrough you are recording and, when you tap it, to center the map on your position (that position stays on your device). It is read while the app is open, never in the background, and the app works normally if you decline. We do not build a location history and we do not track your movement between walkthroughs.
• Camera and photo library: used when you attach a photo, set a profile picture, scan a governing document, or ask for AI help drafting an RFP scope. The app opens the camera or the picker only when you tap the control that needs it, and it reads only the images you select.
• Microphone and speech recognition: used to dictate meeting notes and motion text. Transcription runs on your device. If a device cannot do on-device recognition, the app tells you dictation is unavailable there rather than sending your audio to a speech service. The recognized text becomes part of the note you are writing; the audio itself is never uploaded or stored by us.
• Document scanning: text recognition on pages you scan runs on your device using the operating system text recognizer. The recognized text is uploaded when you save the document, the same as text you type in yourself.
• Calendar: write-only. When you choose to sync a meeting, the app adds that event to a Common Elements calendar on your device. It never reads, stores, or transmits the events already on your calendar.
• Push notifications: if you allow them, the device push token is stored alongside your account so we can deliver the notifications you turned on. It is a device identifier, not an advertising identifier.

Crash and performance monitoring: the app uses Sentry to report crashes and slow screens so we can fix them. A report includes the error, the screens you visited just before it, and basic device and app-version details. We configure Sentry not to attach your name, email, or other account details to these reports.

Product analytics: the app also records a small, fixed set of product events, such as viewing an association page, following an association, running a search, or working with an RFP, so we can tell which features people actually use. These events are tied to your account while you’re signed in, or to a random identifier stored on your device before that. The app carries no advertising, attribution, or data-broker SDK of any kind, we do not sell this data, and it is never used to track you across other companies’ apps or sites. The app does check our update service for app updates, which is delivery, not measurement.

You can delete your account from inside the app under Settings. That runs the same deletion described under “Your rights” below rather than sending you to the website.

We use the data above to operate the platform, authenticate users, route notifications, deliver email, prevent abuse, investigate security incidents, debug errors, and improve the product. Membership status determines what you can see on the platform. That’s enforced at the database level, not by UI hiding.

We do not sell personal information, and we do not share it with advertisers. We use AI only in the limited way described under “AI features” below, and never to train an outside provider’s general models.

We use AI in the features below. Most run when you ask; some run automatically, such as forum thread summaries and sorting email sent to our team. In each case the content is sent from our own servers to our AI provider (Anthropic), routed through Vercel’s AI Gateway. Our provider credentials stay on our servers and are never shipped inside the mobile app. These are the features:

• Ember, the in-product assistant: answers questions about associations, vendors, and statutes, and, when you ask, about your own account, by calling tools against Common Elements’ data and, where relevant, your own RFPs, proposals, messages, and notifications under the same permissions that apply everywhere else on the platform. It cites what it drew from. Actions that would change your data, such as drafting an RFP or sending a message, are never taken automatically; you review and approve each one first. We log Ember conversations so we can review whether its answers are accurate and improve them.
• Document analyzer: the text of a governing document you upload, read and summarized against the relevant statutes, and used to extract basic facts such as association name, dates, and unit count. Governing documents can contain personal data such as owner names, addresses, and unit identifiers, so we treat this the same as the rest of your content.
• Budget and reserve study import: a budget or reserve study file you choose to import, read so its figures can be turned into a structured draft you review and edit.
• Site photo assist: a photograph you take or pick while drafting an RFP scope, described so the scope can be pre-filled. The app captures these photos with EXIF metadata disabled, so no embedded location or camera detail travels with the image.
• Other AI-assisted features: importing a resume into your profile; drafting an RFP and summarizing the proposals submitted to your RFP (which includes other parties’ proposals); summarizing long forum threads (which includes other members’ posts); pulling facts and key dates from documents you store, such as insurance policies, reserve studies and SIRS reports; drafting and checking meeting packets; writing an association’s weekly note; summarizing public records in the browser extension; and sorting email sent to our team inbox.

Content sent to these features is processed to return the result. Under our provider’s commercial terms it is not used to train the provider’s models. The AI extracts, describes, and summarizes; it does not give legal advice or decide whether anything in your document is enforceable.

To run the platform we share specific data with these service providers:

• Supabase (PostgreSQL hosting, authentication, file storage). All account and platform content data.
• Vercel (web hosting, edge networking, Vercel Analytics, and the AI Gateway that routes AI requests to Anthropic). Request metadata, edge cache, page-view measurements, and the AI content described above in transit.
• Resend (email delivery, both platform notifications and newsletters or other marketing email). Email addresses and message bodies.
• Stripe (billing). Customer record and payment metadata; no card numbers ever touch our servers.
• Sentry (error and performance monitoring, web and mobile). Stack traces, request metadata, and crash reports. Personally identifying details are scrubbed where feasible on the web and excluded by configuration on mobile.
• PostHog (product analytics, web and mobile). Which pages and features you use, clicks captured automatically, and, for a sample of web visits, a session replay with all text and inputs masked. Tied to your account while you’re signed in. Used to understand usage and fix broken flows, not for advertising. We do not sell this data.
• Google Analytics (website traffic measurement). Pages visited, referrer, device and approximate location derived from IP address. Not used by us for advertising.
• Mapbox and geocoding providers (maps and address lookup). Map requests from your browser, and association and business addresses we look up. Not your account data.
• Sign-in and calendar connections (Google, LinkedIn and Apple sign-in; Zoom for live sessions and meetings scheduled through Common Elements). Sign-in providers share only what is needed to sign you in, and only when you choose that option; Zoom receives the meeting details and attendees.
• Anthropic (AI processing). The content sent to the AI features listed above, including your conversations with Ember and the account records Ember reads to answer you. Sent to return the result. Under the provider’s commercial terms, not used to train its models. See “AI features” above.

We use cookies and browser storage that are necessary to keep you signed in and to remember your in-product preferences (such as your active organization context and notification preferences). We also use analytics cookies and browser storage set by PostHog and Google Analytics to measure how the site is used. We do not set third-party advertising cookies.

We keep your account data for as long as your account is active. Forum posts, RFPs, proposals, reviews, and messages persist for the operational lifetime of the platform so that audit trails remain intact for boards and counsel. That’s a fiduciary expectation, not a marketing one. Server logs and error reports are retained for up to 90 days. Analytics events and session replays are kept under our analytics providers’ retention settings. If you close your account, we retain content you authored in shared contexts (forum posts, RFPs, reviews) but disassociate it from your identifying account information unless we’re legally required to keep it linked.

You can delete your own account at any time from Settings on the web or in the app, or by emailing privacy@commonelements.com. Deleting your account starts a 30-day window during which it can still be restored; after that window, it and your personal data are permanently removed. If you’re the sole admin of an organization, you’ll need to transfer that role or close the organization first. You can request a copy of your personal data, correct inaccuracies, or restrict processing the same way. If you don’t have a Common Elements account but appear in our public-record directory data as an officer or board member, see “Public-record and directory data” above for how to reach us. If you’re a California resident, you have additional rights under the California Consumer Privacy Act; if you’re based in the EEA or UK, GDPR rights apply. We respond to verified requests within 30 days.

Account access requires authentication. Database row-level security ensures users only see what their organization membership entitles them to. Production traffic is HTTPS-only with strict transport security; HSTS, frame-busting, and a content security policy are enforced at the application edge. We rotate credentials, scan dependencies for known vulnerabilities, and document our incident response procedure.

No system is impervious. If we discover a security incident that affects your data, we’ll tell you what happened, what we did about it, and what you should do, without spin.

Common Elements is for adults: you must be 18 or older to create an account. We do not knowingly collect data from children under 13. If you believe a minor has created an account, contact us and we’ll delete it.

We’ll update this page when our practices change. Material changes are announced via in-app notification and email at least 30 days before they take effect. The “last updated” date at the top of this page reflects the most recent revision.

Privacy questions and requests:
privacy@commonelements.com

Legal notices by mail: